Implement Risk Threshold Matrix

[mmoseritemis]

Implement an object within the schema that allows for a Risk Threshold Matrix to be defined. This matrix benefits the user by allowing them to codify how a risk should be treated based on the final calculated Risk value.

Once this is implemented into the schema, create an example of this Risk matrix within the json format

[JohnASRG]

@claude

[claude]

Claude finished @JohnASRG's task in 3m 35s —— View job • claude/issue-29-20260226-1441 • Create PR ➔

---

Implementing Risk Threshold Matrix

• Gather context (read schema and examples)
• Design Risk Threshold Matrix object
• Update JSON schema (spec/json/rdx.schema.json)
• Create example JSON (examples/rdx-risk-threshold-example.json)
• Update tools/validate.sh to include new example
• Update REQUIREMENTS.md (RDX-107 linked to implementation)
• Validate changes (JSON structure verified; ajv-cli not installed in CI environment — validation will run in PR CI)
• Commit and push

---

Summary

Added riskThresholdMatrix as an optional array in riskSet in the JSON schema. This allows organizations to formally codify how risks should be treated based on the final calculated risk value.

Schema object structure (spec/json/rdx.schema.json):

• Required: id, title, thresholds[]
• Optional: description, methodId (ref to scoring method), references
• Each threshold entry requires:
  • band — risk band label (e.g., "High", "Medium", "Low")
  • requiredTreatment — one of treat | avoid | accept | share
• Each threshold optionally supports:
  • scoreRange — { min, max } numeric/string range for the band
  • escalationRequired — boolean flag for management escalation
  • rationale — justification text
  • references — policy/standard references

New example (examples/rdx-risk-threshold-example.json):

• Demonstrates three threat scenarios with risk scores mapping to Very High, High, and Low bands
• Includes an OEM Cybersecurity Risk Acceptance Policy threshold matrix
• Shows how riskTreatmentDecisions reference the matrix bands (with relationships linking decisions back to the matrix)

|

[JohnASRG]

@claude
We need to make a few small changes...

1. The riskThresholdMatrix should state the allowed risk treatment strategies (treat | avoid | accept | share), not required. For example a risk is High, then only reduce, and avoid are allowed. Or for low, all 4 risk reduction strategies might be allowed.
2. Change the strategies from treat | avoid | accept | share -> reduce | avoid | accept | share
3. Risk treatment should be determined as part of the methodology section and not for each specific risk. The methodology would then be interpreted and overlaid with the risk data when interpreted.

[JohnASRG]

@claude

[claude]

Claude finished @JohnASRG's task in 2m 46s —— View job • claude/issue-29-20260310-1628 • Create PR ➔

---

Implementing Risk Threshold Matrix Updates

• Gather context (read schema, validate.sh, REQUIREMENTS.md)
• Update riskTreatmentDecisions.decision enum: treat -> reduce
• Add riskThresholdMatrix to methods items (methodology section, with allowedTreatments array)
• Create example JSON demonstrating the feature
• Update tools/validate.sh to include new example
• Commit and push

---

Summary of changes

All three requested changes are implemented:

1. allowedTreatments (array, not single required value)
Each threshold band now specifies an array of permitted treatment strategies. For example:

• "Very High" → ["reduce", "avoid"] — acceptance/sharing is prohibited
• "Low" → ["reduce", "avoid", "accept", "share"] — all strategies permitted

2. treat renamed to reduce
Updated in both riskTreatmentDecisions.decision enum and the new allowedTreatments enum inside riskThresholdMatrix.

3. riskThresholdMatrix moved into methods
The matrix now lives inside each methods item (alongside name, version, factors). This means the threshold policy is part of the methodology definition and is overlaid on risk data during interpretation — not attached to individual risks.

Files changed:

• spec/json/rdx.schema.json — schema updates
• examples/rdx-risk-threshold-example.json — new example with a four-band OEM policy matrix
• tools/validate.sh — added new example to validation

---

• claude/issue-29-20260310-1628